Add a 'setKeepCAFs' external function (#3900)